Moderate Vulnerability in python3-urllib3: Information Disclosure via Cross-Origin Redirects
Summary
ALSA-2026:36732: Moderate: python-urllib3 security update. Affects python3-urllib3 versions < 1.24.2-10.el8_10. Fixed in 1.24.2-10.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-urllib3 is a widely used HTTP library for Python that allows developers to send HTTP requests easily. It supports features such as connection pooling, client-side SSL/TLS verification, and file uploads. However, due to its extensive use in web applications, any vulnerabilities can lead to significant security risks, particularly in handling sensitive data.
Vulnerability Detail
The vulnerability identified as CVE-2026-44431 allows for information disclosure through cross-origin redirects that forward sensitive headers. This means that an attacker could potentially exploit this flaw to access sensitive information that should not be exposed, leading to unauthorized data exposure and privacy breaches.
How To Fix
Minimum fixed version
1.24.2-10.el8_10
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict Content Security Policies (CSP) to limit the origins that can be accessed by your application. This can help mitigate the risk of sensitive headers being exposed through cross-origin requests.
Conclusion
The python3-urllib3 package has a moderate vulnerability that can lead to information disclosure through cross-origin redirects. It is crucial to update to the patched version to safeguard sensitive information. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for python3-urllib3 →
FAQ
CVE-2026-44431 is a vulnerability in python3-urllib3 that allows for information disclosure via cross-origin redirects.
If your application uses python3-urllib3 and handles sensitive data, this vulnerability could expose that data to unauthorized parties.
If an immediate update is not possible, consider implementing strict CSPs as a temporary measure to reduce exposure.
More details can be found on the CVE page for CVE-2026-44431, which outlines the impact and technical details of the vulnerability.
Vulert allows you to monitor and receive alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, without needing to access the code directly.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
